Methods, systems, and computer readable media for adaptive assignment of an active security association instance in a redundant gateway configuration
View Patent ↗According to one aspect, the subject matter described herein includes a method for communicating an encrypted data packet. The method includes steps occurring at a first gateway node. The method also includes receiving a data packet from a first host. The method further includes determining that a first security association (SA) instance associated with the data packet is in an inactive state. The method further includes identifying a second SA instance that is both associated with the data packet and in an active state. The method further includes forwarding the data packet to the second SA instance.
1. A method for communicating encrypted data, the method comprising:
at a first gateway node:
receiving a first data packet from a second gateway node, wherein the first gateway node and the second gateway node are configured to be in a redundant gateway configuration, the first gateway node having a first security association (SA) instance associated with the first data packet and in an active state, the second gateway node having a second SA instance associated with the first data packet and in an inactive state, wherein each of SA instances is a process to assure secure communications between the first gateway node and the second gateway node and each gateway node has both of an active SA instance and inactive SA instance;
detecting that an unbalanced condition exists between the first SA instance and the second SA instance;
determining at the first gateway node that the second SA instance should be designated as active and the first SA instance should be designated as inactive;
designating the second SA instance as active and forwarding the first data packet to the second gateway node; and
designating the first SA instance as inactive.
2. The method of claim 1 comprising: receiving a second data packet; determining that the first SA instance is designated as inactive; identifying the second SA instance as both being associated with the second data packet and being designated as active; and forwarding the second data packet to the second SA instance.
3. The method of claim 1 wherein the determination is based on a total number of data packets received by the first gateway node during a sampling period and a total number of data packets received by the second gateway node during the sampling period.
4. The method of claim 1 wherein the determination is based on a processor utilization for the first gateway node and a processor utilization for the second gateway node.
5. The method of claim 1 wherein the determination is based on a percentage of total traffic handled by the first gateway node during a sampling period that is encrypted and a percentage of total traffic handled by the second gateway node during the sampling period that is encrypted.
6. The method of claim 1 wherein the determination is made in response to at least one of a time based trigger; a packet count based trigger; a byte count based trigger; a configuration event trigger; an external network trigger; and a resource limit threshold trigger.
7. The method of claim 1 wherein designating the second SA instance as active comprises marking the first data packet to indicate that the second SA instance should assume a role as active SA instance and sending the first data packet to the second gateway node.
8. The method of claim 7 wherein marking the first data packet further comprises indicating in the first data packet that the unbalanced condition exists.
9. The method of claim 1 further comprising:
receiving periodic sequence number updates at the inactive first SA instance from the active second SA instance.
10. A system for communicating encrypted data, the system comprising:
a first gateway node having both of an active security association (SA) instance and inactive SA instance in a redundant gateway configuration with a second gateway node, the first gateway node comprising:
a communication interface; and
a SA module configured configured to:
utilize the communication interface to receive, from the second gateway node, a data packet;
determine that a first SA instance at the first gateway node and associated with the data packet is in an active state, wherein each of SA instances is a process to assure secure communications between the first gateway node and the second gateway node and each gateway node has both of an active SA instance and inactive SA instance;
detecting that an unbalanced condition exists between the first SA instance and a second SA instance at the second gateway node;
designating the second SA instance as active and forwarding the data packet to the second gateway node; and
designating the first SA instance as active.
11. The system of claim 10 , wherein the SA module is further configured to:
designate the first SA instance as inactive.
12. The system of claim 11 wherein the data packet comprises an Internet protocol security (IPsec) packet.
13. The system of claim 10 wherein the first SA instance is configured to calculate a total number of packets forwarded by the second SA instance to the first SA instance.
14. The system of claim 10 wherein the first SA instance is configured to identify the data packet as having been forwarded by the second SA instance.
15. The system of claim 10 wherein the first SA instance is further configured to mark the data packet to indicate that the unbalanced condition exists in response to determining that the unbalanced condition exists.
16. The system of claim 10 wherein the first SA instance is configured to designate the second SA instance as active by marking the data packet to indicate that the second SA instance should assume a role as active SA instance and sending the data packet to the second gateway node.
17. A non-transitory computer readable medium comprising computer executable instructions that when executed by a processor of a computer control the computer to perform steps comprising:
at a first gateway node having a first security association (SA) instance being active:
receiving a plurality data packets forwarded from a second gateway node having a second SA instance, the second SA instance being inactive, wherein each of SA instances is a process to assure secure communications between the first gateway node and the second gateway node and each gateway node has both of an active SA instance and active SA instance;
determining that the second SA instance receives more data packet traffic than does the first SA instance;
marking at the first gateway node a first one of the plurality of data packets to indicate that an unbalanced condition exists between the first SA instance and the second SA instance; and
forwarding the first data packet to the second SA instance to designate the second SA instance as active.
18. The computer readable medium of claim 17 further comprising computer executable instructions that when executed by a processor of a computer control the computer to perform at a first gateway node having the first SA instance:
marking the first one of the plurality of data packets to indicate the second SA instance should assume a role as an active SA instance.
19. The computer readable medium of claim 17 further comprising computer executable instructions that when executed by a processor of a computer control the computer to perform at a first gateway node having the first SA instance:
detecting the unbalanced condition by one or more of the following techniques:
detecting a total number of data packets received by the first gateway node during a sampling period and a total number of data packets received by the second gateway node during the sampling period;
detecting a processor utilization for the first gateway node and a processor utilization for the second gateway node; and
detecting a percentage of total traffic handled by the first gateway node during a sampling period that is encrypted and a percentage of total traffic handled by the second gateway node during the sampling period that is encrypted.
20. The computer readable medium of claim 17 further comprising computer executable instructions that when executed by a processor of a computer control the computer to perform at a first gateway node having the first SA instance:
receiving a subsequent data packet; determining that the first SA instance is designated as inactive; identifying the second SA instance as both being associated with the subsequent data packet and being designated as active; and forwarding the subsequent data packet to the second SA instance.